jails Which type of jail for production use cases?

degauss4

degauss4

Hello everyone,

I am learning the concept of jails and I am just testing things out using "Thick" jails (meaning an isolated complete userland for the jail). I have read the handbook and Absolute FreeBSD yet I am curious to find out which type of jails are you using in your environment, be it either your home network or work environments. In my case, I want to have jails for essential network services (DNS, DHCP, etc), migrate some of my home network services that are on Linux VMs to FreeBSD jails and then try out new things. I might migrate my linux services to Thick jails first and then see how it goes from there.

I see the following use cases and benefits
  • Thick jails: good for isolation yet heavy on maintenance and manual work.
  • Thin jails: seize the benefits of ZFS datasets, and set default configuration on the dataset. Every other jail clones the dataset and then adds the jails packages and configuration on its own dataset. Might pose security or dependency risks based on how you configure the base template
  • Nullfs jails: I read this on Absolute FreeBSD and it's wonderful that the base FreeBSD install is able to do this (which is like magic to me) but I really don't see a use case for this in a home network. Lots of space benefits but might be very hard to manage.
Networking is also hard to decide. Since I am just testing I am using the same network interface as the host. In a more production environment however I want to ideally separate everything, a dedicated interface for the host and another interface and possibly VLANs too for the jails.

In my case, I am interested in having a default configuration for a new jail so it can be configured later. An example is I want to add a public ssh key to the root user so it can be auto configured with Ansible. That means that for the new jail, the ssh service must be configured and also the public key needs to be added to the root user. Creating a template using a thin jail might work for this case, right?

Can anyone share their experiences on using jails and what did you learn on your preferred setup? Thanks!
 
You might want to take a look at Dan Langille's presentation at EuroBSDCon 2019. He lists pros and cons for both thick and thin jails. I've linked to his slides, but if you search you can probably find the whole presentation somewhere.
 
My experience. Don't use jail managers - use the standard toolset. Thick jails are for production environments. Thin jails are temporary for experimenting. VNET jails have more overhead (bridge/epair). SharedIP jails are good enough for most cases. Use zfs on the host. Use jail templates. I jail services that are public-internet-facing full-time (eg, email server). Use the pf firewall to control access to most everything.

I know nothing about Ansible.
 
Bucky said:
My experience. Don't use jail managers - use the standard toolset. Thick jails are for production environments. Thin jails are temporary for experimenting. VNET jails have more overhead (bridge/epair). SharedIP jails are good enough for most cases. Use zfs on the host. Use jail templates. I jail services that are public-internet-facing full-time (eg, email server). Use the pf firewall to control access to most everything.

I know nothing about Ansible.
Click to expand...
I agree with using the standard toolset, it is already very strong.
What do you mean by using "SharedIP" jails? Is it just the standard setting of using the same interface as the host (but a dedicated IP address?
 
degauss4 said:
I agree with using the standard toolset, it is already very strong.
What do you mean by using "SharedIP" jails? Is it just the standard setting of using the same interface as the host (but a dedicated IP address?
Click to expand...
Yes. My server has two interfaces - one faces the WAN and the other faces the LAN. I put the sharedIPjail IP address on the LAN interface.
 
degauss4 said:
I agree with using the standard toolset, it is already very strong.
What do you mean by using "SharedIP" jails? Is it just the standard setting of using the same interface as the host (but a dedicated IP address?
Click to expand...
You can use your LAN IP address space for you jail(s).
ea. 192.168.1.10 in your jail with 192.168.1.1 as the gateway LAN IP for your jail, which is also the GWIP of your host, if that's how your LAN IP spce is set up. You should get familiar with basic concepts of routing and firewall rules, or get dedicated routing/fw appliance.
 
You must log in or register to reply here.
Back
Top